How to generate SharePoint Online site audit report using PowerShell?

Question

I want to generate the audit log report with different activities and download to the local disc from SharePoint Online Site.

The functionality is provided by Share Gate tool which I assume to be implemented using PowerShell.

Any reference or code of the CSOM PowerShell or PNP to generate the report?

There is a tool available at this location . I want to develop the code which will extract the reports of SharePoint activities in this tool.

Thanks in advance.

Answer 1

There is a demo to get the audit data in one day in SharePoint online by PowerShell.

You should get your site id and change to your site id in the PowerShell script. And you also could change the time interval.

And it will save the audit data to the csv file on the local computer.

#Set-ExecutionPolicy RemoteSigned

# Option 1 - This can be used to be prompted for credentials
$UserCredential = Get-Credential

# Create the session to Exchange Online
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -Uri https://outlook.office365.com/powershell-liveid/  -Credential $UserCredential -Authentication Basic -AllowRedirection

# Import the Exchange Online commands
Import-PSSession $Session
$csvFile = "c:\test\auditlog2.csv"

# Setup our start and end dates to pull back events
#$start = Get-Date
$end = Get-Date
$start = $end.AddDays(-1)
$i = 1;
$startTime = Get-Date

do
{
    $AuditData = Search-UnifiedAuditLog -StartDate $start -EndDate $end -RecordType SharePointFileOperation -ResultSize 5000 -SessionCommand ReturnLargeSet -SessionId "ExtractLogs" -SiteIds yoursiteid
    $ConvertedOutput = $AuditData | Select-Object -ExpandProperty AuditData | ConvertFrom-Json
    $ConvertedOutput | SELECT CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent | Export-csv $csvFile -NoTypeInformation -Append -Force 
    Write-Host $i++ . $AuditData.Count
    $i = $i + 1;
}
Until($AuditData.Count -eq 0)

$endTime = Get-Date
Write-Host $startTime - $endTime

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

#Get Site Id
$credential = Get-Credential
$context = New-Object Microsoft.SharePoint.Client.ClientContext("yoursiteurl")
$context.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($credential.UserName,$credential.Password)
$site = $context.Site 
$context.Load($site)
$context.ExecuteQuery();
$site.Id

More references:

Retrieving Office 365 Audit Data using PowerShell.

Office 365/Sharepoint Online - PowerShell Script To Call Search API And Get The Result.